netdev - Re: [PATCH v1 net] ip: Return drop reason if in_dev is NULL in ip_route_input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9ba9c9c5-7f55-403a-a0b1-6db869be90c9@kernel.org>
Date: Thu, 5 Dec 2024 20:09:00 -0700
From: David Ahern <dsahern@...nel.org>
To: Kuniyuki Iwashima <kuniyu@...zon.com>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
 Simon Horman <horms@...nel.org>
Cc: Menglong Dong <menglong8.dong@...il.com>,
 Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org,
 syzkaller <syzkaller@...glegroups.com>
Subject: Re: [PATCH v1 net] ip: Return drop reason if in_dev is NULL in
 ip_route_input_rcu().

On 12/5/24 7:07 PM, Kuniyuki Iwashima wrote:
> syzkaller reported a warning in __sk_skb_reason_drop().
> 
> Commit 61b95c70f344 ("net: ip: make ip_route_input_rcu() return
> drop reasons") missed a path where -EINVAL is returned.
> 
> Then, the cited commit started to trigger the warning with the
> invalid error.
> 
> Let's fix it by returning SKB_DROP_REASON_NOT_SPECIFIED.
> 
> [0]:
> WARNING: CPU: 0 PID: 10 at net/core/skbuff.c:1216 __sk_skb_reason_drop net/core/skbuff.c:1216 [inline]
> WARNING: CPU: 0 PID: 10 at net/core/skbuff.c:1216 sk_skb_reason_drop+0x97/0x1b0 net/core/skbuff.c:1241
> Modules linked in:
> CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.12.0-10686-gbb18265c3aba #10 1c308307628619808b5a4a0495c4aab5637b0551
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
> Workqueue: wg-crypt-wg2 wg_packet_decrypt_worker
> RIP: 0010:__sk_skb_reason_drop net/core/skbuff.c:1216 [inline]
> RIP: 0010:sk_skb_reason_drop+0x97/0x1b0 net/core/skbuff.c:1241
> Code: 5d 41 5c 41 5d 41 5e e9 e7 9e 95 fd e8 e2 9e 95 fd 31 ff 44 89 e6 e8 58 a1 95 fd 45 85 e4 0f 85 a2 00 00 00 e8 ca 9e 95 fd 90 <0f> 0b 90 e8 c1 9e 95 fd 44 89 e6 bf 01 00 00 00 e8 34 a1 95 fd 41
> RSP: 0018:ffa0000000007650 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: 000000000000ffff RCX: ffffffff83bc3592
> RDX: ff110001002a0000 RSI: ffffffff83bc34d6 RDI: 0000000000000007
> RBP: ff11000109ee85f0 R08: 0000000000000001 R09: ffe21c00213dd0da
> R10: 000000000000ffff R11: 0000000000000000 R12: 00000000ffffffea
> R13: 0000000000000000 R14: ff11000109ee86d4 R15: ff11000109ee8648
> FS:  0000000000000000(0000) GS:ff1100011a000000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000020177000 CR3: 0000000108a3d006 CR4: 0000000000771ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000600
> PKRU: 55555554
> Call Trace:
>  <IRQ>
>  kfree_skb_reason include/linux/skbuff.h:1263 [inline]
>  ip_rcv_finish_core.constprop.0+0x896/0x2320 net/ipv4/ip_input.c:424
>  ip_list_rcv_finish.constprop.0+0x1b2/0x710 net/ipv4/ip_input.c:610
>  ip_sublist_rcv net/ipv4/ip_input.c:636 [inline]
>  ip_list_rcv+0x34a/0x460 net/ipv4/ip_input.c:670
>  __netif_receive_skb_list_ptype net/core/dev.c:5715 [inline]
>  __netif_receive_skb_list_core+0x536/0x900 net/core/dev.c:5762
>  __netif_receive_skb_list net/core/dev.c:5814 [inline]
>  netif_receive_skb_list_internal+0x77c/0xdc0 net/core/dev.c:5905
>  gro_normal_list include/net/gro.h:515 [inline]
>  gro_normal_list include/net/gro.h:511 [inline]
>  napi_complete_done+0x219/0x8c0 net/core/dev.c:6256
>  wg_packet_rx_poll+0xbff/0x1e40 drivers/net/wireguard/receive.c:488
>  __napi_poll.constprop.0+0xb3/0x530 net/core/dev.c:6877
>  napi_poll net/core/dev.c:6946 [inline]
>  net_rx_action+0x9eb/0xe30 net/core/dev.c:7068
>  handle_softirqs+0x1ac/0x740 kernel/softirq.c:554
>  do_softirq kernel/softirq.c:455 [inline]
>  do_softirq+0x48/0x80 kernel/softirq.c:442
>  </IRQ>
>  <TASK>
>  __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:382
>  spin_unlock_bh include/linux/spinlock.h:396 [inline]
>  ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline]
>  wg_packet_decrypt_worker+0x3ba/0x580 drivers/net/wireguard/receive.c:499
>  process_one_work+0x940/0x1a70 kernel/workqueue.c:3229
>  process_scheduled_works kernel/workqueue.c:3310 [inline]
>  worker_thread+0x639/0xe30 kernel/workqueue.c:3391
>  kthread+0x283/0x350 kernel/kthread.c:389
>  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244
>  </TASK>
> 
> Fixes: 82d9983ebeb8 ("net: ip: make ip_route_input_noref() return drop reasons")
> Reported-by: syzkaller <syzkaller@...glegroups.com>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>
> ---
>  net/ipv4/route.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 

Reviewed-by: David Ahern <dsahern@...nel.org>